Why would anyone use a single passphrase for several datasets?
I generally do not endorse reusing passwords, but when setting up a ZFS filesystem for home use, it is not unheard of to use a single (secure) passphrase across several of those. That's because the reason behind splitting up pools into multiple datasets is the granular control over their properties and not the resulting fun of having to type in multiple passphrases.
Obviously, the more usual way of going about it would be using a keystore, or simply protecting one dataset with a passphrase and unlocking all the others with the keys stored within. This method has its downsides however and for home use, I do feel more confident about having everything I need to unlock my data with inside of my head.
So I wrote a simple bash script which asks for a passphrase and proceeds to unlock all (or optionally specified) datasets and optionally mounts them. You can find it in this repo: github.com/gbytedev/zfs-multi-mount.
The script will ask for a passphrase and go dataset by dataset attempting to load the keys. As soon as it encounters a dataset the key for which cannot be loaded, it prompts for a new passphrase.
Examples of usage
Load keys of all datasets and mount them
Load keys for specific datasets and mount them
- zfs-multi-mount.sh pool/dataset1 pool/dataset2 pool/dataset3
Load keys without mounting the datasets
- zfs-multi-mount.sh --no-mount
Unlocking ZFS datasets during boot time using a systemd service
Data that is needed during system start needs to be decrypted during the boot process. An example of this is an encrypted home directory.
The script called by the following service will have to live in some unencrypted location. In this example, it is /opt/scripts.
Create the systemd service file
- Description=Import keys for all datasets
- ExecStart=/opt/scripts/zfs-multi-mount.sh --systemd --no-mount
The [Unit] section tells the service to be run after ZFS pools are imported and before the datasets are mounted. If the script errors out (because of too many authentication attempts, or because the datasets cannot be found), the user will be dropped to an emergency shell.
In [Service] the service is instructed to run the script, which in turn is told to only load keys for datasets instead of mounting them (--no-mount|-n as this is taken care of by a ZFS service) and that it is being run within the systemd context (--systemd|-s).
Enabling the new service
Now all that is left is to enable the service:
- systemctl enable zfs-load-key.service
You can find the script in this repo: github.com/gbytedev/zfs-multi-mount. Let me know if you find it useful and how you would improve it.
Feel free to look at my other ZFS bash script that takes care of snapshotting, replication and rotation: zfsbud.